A hash doesn't allow you to store passwords, it only allows to verify a provided password is identical to the expected one. You can't get back a password that have been hashed.
If your goal is only to check passwords, that's OK.
My goal is to check passwords indeed, and to prevent storing them as plain text.
Indeed, Lua 5.2 has binary operators allowing to compute MD5 or similar algorithms. Probably slower than a C version, but I suppose you won't check thousands of password per second, so it should be OK.
AFAIK, most Lua libraries with native C code will need to be recompiled for Lua 5.2. I had to do that for lfs, luasocket, lpeg...
